Specialists of the information security company Positive Technologies found out that foreign groups of hackers organized and motivated for targeted attacks, the so-called Advanced Persistent Threat (APT), began to use infrastructure elements located on the territory of the Russian Federation more often in attacks on Russian organizations.
APT is a complex targeted threat that is regularly organized by entire states. Positive Technologies registered three such incidents in the spring of 2021. This number of attacks has never happened before.
“Over the past year, we have mostly observed this behavior among hacker groups with Asian roots,” said Denis Kuvshinov, head of the information security threat research at the Positive Technologies security expert center.
As the expert explained, hackers need access to equipment on the territory of the Russian Federation primarily to mask their activity during attacks. By doing this, malicious traffic is passed off as local, that is, trusted. Local traffic is often less closely analyzed by security services than foreign traffic.
The victims of attackers can also be different, it depends on which group is working. For example, Asian hackers are most likely to target state-owned enterprises.
“We expect the attacks to target government facilities and critical infrastructure,” said Anastasia Tikhonova, Head of the Threat Intelligence Complex Threat Research Group at Group-IB.
According to Positive Technologies, Russian equipment can also be used by foreign hackers for attacks abroad. In this case, the infrastructure elements serve as a disguise for “Russian hackers”.
“The cases of “government Russian hackers” are taken by the CIA or the FBI, who have difficulties in relations with their Russian colleagues. The government allocates even more money for cybersecurity. Everyone is happy,” the expert explained.
